Privacy policy

This policy explains how Atte ACADEMY n.o. processes the personal data of visitors to atte.academy, people who enquire about coaching or club membership, and news subscribers. Last updated: October 28, 2026. This is an English translation; if the versions differ, the Slovak version applies.

1. Controller

Atte ACADEMY n.o., a non-profit organization providing services of general interest (nezisková organizácia)
registered office: Hlavná 27, 917 01 Trnava, Slovak Republic
Company ID (IČO): 50086120
registered in: the Register of Non-profit Organizations kept by the District Office Trnava, No. VVS/NO-246/2015 (Register neziskových organizácií, Okresný úrad Trnava)
statutory body: Jozef Hrušovský, director

Privacy contact: jozef@atte.academy. General club contact: info@atte.academy, +421 948 555 990.

2. Overview

3. Contact form, coaching enquiries and club applications

• Data: full name, email, phone, message type (club membership, coaching, partnership, other question), the membership payment option for club applications, for coaching enquiries optionally your target race and date, your triathlon experience and your main coaching goal, your message, the form language (Slovak or English) and optional consent to use your name or photo.
• Purpose and legal basis: for club applications and coaching enquiries, steps taken at your request before entering into an agreement (Art. 6(1)(b) GDPR); for other messages, our legitimate interest in answering your question (Art. 6(1)(f) GDPR).
• How it works: the website does not store the form in any database. A server function on Cloudflare checks the data and sends it by email, via the Resend service, to the club’s mailbox. We reply from the club mailbox.
• Required data: name and email; for club applications also phone and payment option. Without them we can’t reply or process your application.
• Retention: up to 12 months from submission if no membership follows.
• No automatic subscription: sending the form does not subscribe you to our news and you won’t receive marketing emails.
• Name or photo: we use them in club communications only with your voluntary consent (Art. 6(1)(a) GDPR). You can withdraw consent by email at any time.

4. News subscription

• Sign-up: only through the “Get our news” form in the website footer, by entering your email and ticking the consent box (it is not pre-ticked).
• Data: email address, date and time the record was created, membership of the subscriber list and subscription status (subscribed / unsubscribed). The list is kept in the Resend service.
• Purpose and legal basis: sending Atte ACADEMY news based on your consent (Art. 6(1)(a) GDPR). Providing your email is voluntary.
• Signing up again: if you are already subscribed, no new record is created. If you unsubscribed in the past, the website will not subscribe you again; email us if you’d like our news again.
• Unsubscribing: at any time via the unsubscribe link in the newsletter or by email to jozef@atte.academy. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
• Retention: until you unsubscribe. After that we keep only your email with an unsubscribe record so we don’t send you news by mistake; on request we delete it completely.

5. Website operation and technical logs

The website runs on Cloudflare Pages. On every visit Cloudflare processes your IP address and technical request data (for example time, page address and browser type) to deliver the page and protect it against attacks (legitimate interest, Art. 6(1)(f) GDPR).

Our form server functions do not record message contents or full email addresses. On an error or a successful submission they log only the message type, the message identifier at Resend or the email domain. To protect the forms from flooding, the function keeps your IP address in memory for no more than 10 minutes.

6. Cookies, measurement and embedded videos

Without your consent the website loads no analytics or advertising tools and sets no cookies. The banner offers “Accept all”, “Reject non-essential” and “Manage preferences” with equal weight; in the preferences you choose each category separately (optional categories are never pre-ticked):

• Essential (always on): delivering and securing the site (section 5) and remembering your choice in your browser’s storage under the key aa-consent (categories and date of the choice; not sent anywhere).
• Analytics: Google Analytics 4 (Google Ireland Ltd.) and Hotjar (Hotjar Ltd.) — measuring traffic and how the site is used.
• Advertising: Google Ads (Google Ireland Ltd.) and Meta Pixel (Meta Platforms Ireland Ltd.) — ad measurement, targeting and remarketing.

The tools load through Google Tag Manager (GTM-PHRT86R), which the site starts only after you consent to analytics. The site also sends Google Consent Mode v2 signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) — “denied” by default and “granted” according to your choice. Without advertising consent, Meta Pixel does not load. If you allow analytics but not advertising, Google’s advertising tags may send a request without advertising cookies and with ad-click identifiers redacted. Consent to advertising only (without analytics) is saved, but with the current configuration no tool loads.

In our test on October 28, 2026, the tools set these cookies after consent: _ga, _ga_MF2BM22P53 (Google Analytics), _gcl_au (Google Ads), _fbp (Meta) and, on the doubleclick.net domain, IDE (Google). Hotjar may set its own cookies. Retention follows each tool’s settings.

The legal basis is your consent (Art. 6(1)(a) GDPR) under Section 109(8) of the Slovak Electronic Communications Act. You can change or withdraw your choice at any time via “Cookie settings” in the footer; on withdrawal the site deletes these tools’ cookies on atte.academy and reloads the page. Cookies on third-party domains (e.g. IDE) can be deleted in your browser settings.

YouTube videos: some pages contain official IRONMAN videos. Until you click play, nothing is loaded from YouTube or Google. When you click, the player loads from youtube-nocookie.com (Google Ireland Ltd. / Google LLC), and YouTube processes your IP address and device and viewing data according to its own terms. The legal assessment of this embed is still under review.

7. Recipients and processors

• Cloudflare, Inc. — website hosting and form server functions (processor).
• Resend (Plus Five Five, Inc.) — delivering contact-form messages by email and keeping the news subscriber list (processor).
• The provider of the club’s email mailboxes — receiving and storing emails.
• Google, Meta and Hotjar — only after you consent to cookies (section 6).
• Google (YouTube) — only after you click play on a video (section 6).

We don’t sell personal data. We disclose it to public authorities only when the law requires it.

8. Transfers outside the EU

Cloudflare and Resend are US companies, so data may also be processed outside the European Economic Area. Their data processing agreements (DPAs) refer to the EU-U.S. Data Privacy Framework, and Resend’s also to the EU Standard Contractual Clauses. For Google, Meta and Hotjar, which load only with consent, and for YouTube, which loads only when you click play, transfers are governed by those providers’ terms. Transfers outside the EEA are possible only with safeguards under Chapter V GDPR.

9. Your rights

• access to your data and a copy of it (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• portability of data you gave us based on consent or a contract (Art. 20),
• objection to processing based on legitimate interest (Art. 21),
• withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

Exercise your rights by email to jozef@atte.academy or in writing to our registered office. We reply without undue delay, usually within one month (Art. 12(3) GDPR), and may ask you to verify your identity.

You have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, dataprotection.gov.sk.

10. Security

The website is available only over an encrypted connection (HTTPS). Access keys to the email service are stored only on the server, never in the browser. The forms check the request origin, filter spam and limit the number of attempts. The website keeps no database of personal data of its own.

11. Automated decision-making

We don’t use your data for automated decision-making or profiling with legal or similarly significant effects. Advertising tools (section 6) may create advertising segments after you consent.

12. Changes to this policy

We update this policy when the way we process data changes. The current version, with its last-updated date, is always on this page.